chore: improve actions #2

.github/workflows/agent-scan.yml

@@ -17,7 +17,7 @@ permissions:
 
 jobs:
   agentscan:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-slim
     steps:
       - name: AgentScan
         id: agentscan

.github/workflows/dependency-review.yml

@@ -18,15 +18,17 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
+          persist-credentials: false
 
-      - name: Check provenance downgrades
-        uses: danielroe/provenance-action@41bcc969e579d9e29af08ba44fcbfdf95cee6e6c # v0.1.1
-        with:
-          fail-on-provenance-change: ${{ inputs.fail-on-provenance-change }}
+      - parallel:
+          - name: Check provenance downgrades
+            uses: danielroe/provenance-action@41bcc969e579d9e29af08ba44fcbfdf95cee6e6c # v0.1.1
+            with:
+              fail-on-provenance-change: ${{ inputs.fail-on-provenance-change }}
 
-      - name: Dependency review
-        if: github.event.pull_request || github.event.merge_group
-        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
-        with:
-          base-ref: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha }}
-          head-ref: ${{ github.event.pull_request.head.sha || github.event.merge_group.head_sha }}
+          - name: Dependency review
+            if: github.event.pull_request || github.event.merge_group
+            uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
+            with:
+              base-ref: ${{ github.event.pull_request.base.sha || github.event.merge_group.base_sha }}
+              head-ref: ${{ github.event.pull_request.head.sha || github.event.merge_group.head_sha }}

.github/workflows/reusable-release.yml

@@ -80,6 +80,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - run: corepack enable
       - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0

.github/workflows/triage-comment.yml

@@ -47,20 +47,21 @@ jobs:
           echo "Comment from collaborator/member/owner - no automated analysis performed." >> $GITHUB_STEP_SUMMARY
 
       - if: steps.check-auth.outputs.is_collaborator != 'true'
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          repository: nuxt/.github
-          ref: ${{ inputs.scripts-ref }}
-          sparse-checkout: scripts/triage
-          path: .shared
+        parallel:
+          - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            with:
+              repository: nuxt/.github
+              ref: ${{ inputs.scripts-ref }}
+              sparse-checkout: scripts/triage
+              path: .shared
+              persist-credentials: false
+
+          - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+            with:
+              node-version: lts/*
 
       - if: steps.check-auth.outputs.is_collaborator != 'true'
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: lts/*
-
-      - name: Analyze comment
-        if: steps.check-auth.outputs.is_collaborator != 'true'
+        name: Analyze comment
         id: analyze
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:

.github/workflows/triage-edited.yml

@@ -24,16 +24,18 @@ jobs:
       contains(github.event.issue.labels.*.name, 'needs reproduction')
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          repository: nuxt/.github
-          ref: ${{ inputs.scripts-ref }}
-          sparse-checkout: scripts/triage
-          path: .shared
-
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: lts/*
+      - parallel:
+          - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            with:
+              repository: nuxt/.github
+              ref: ${{ inputs.scripts-ref }}
+              sparse-checkout: scripts/triage
+              path: .shared
+              persist-credentials: false
+
+          - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+            with:
+              node-version: lts/*
 
       - name: Analyze edited issue
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0

.github/workflows/triage-opened.yml

@@ -67,16 +67,18 @@ jobs:
       !github.event.issue.pull_request
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-        with:
-          repository: nuxt/.github
-          ref: ${{ inputs.scripts-ref }}
-          sparse-checkout: scripts/triage
-          path: .shared
-
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
-        with:
-          node-version: lts/*
+      - parallel:
+          - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+            with:
+              repository: nuxt/.github
+              ref: ${{ inputs.scripts-ref }}
+              sparse-checkout: scripts/triage
+              path: .shared
+              persist-credentials: false
+
+          - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+            with:
+              node-version: lts/*
 
       - name: Analyze and triage issue
         id: triage